A critical security issue has been identified in Cisco Catalyst series PON CGP-ONT-* (Passive Optical Network) switches (CVE-2021-34795), which allows an attacker to connect to the switch with administrative rights by enabling the telnet protocol and using a hardcoded debug account left by the manufacturer in the firmware. This issue only manifests when telnet access is activated in the settings, which is disabled by default.
In addition to the presence of an account with a hardcoded password, two vulnerabilities (CVE-2021-40112, CVE-2021-40113) have also been discovered in the web interface of the discussed models, allowing an unauthenticated attacker who is unaware of the login parameters to execute commands with root privileges and modify the settings. By default, access to the web interface is allowed only from the local network unless this behavior is overridden in the settings.
At the same time, a similar issue (CVE-2021-40119) with a predefined engineering entry point has been identified in the Cisco Policy Suite software, where a pre-configured manufacturer SSH key was installed, allowing a remote attacker to gain access to the system with root privileges.
Source: opennet.ru
